38d9ccc58f31ba3bcde916537d0c5aae080ee575934c6bec522b4656e90879c6

Analysis

max time kernel
140s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9c5ff87d87b833220e0f9c92da8d3dc2_JaffaCakes118.html
Size

64KB
MD5

9c5ff87d87b833220e0f9c92da8d3dc2
SHA1

b8d5a9cc3c4fefd090f364beb6f8c16089778cbc
SHA256

38d9ccc58f31ba3bcde916537d0c5aae080ee575934c6bec522b4656e90879c6
SHA512

6b04dea49fc81766ee5749299574f477f178cf9e65f94837c7a1ccb6aac65b6a0b8c989ef1ae78c2b291ac88ea636ef763dec607886291987d9d377189dbe092
SSDEEP

1536:3Ez3rqgATJkAcg1Xz1PD0y803f5tgjalj7cM:G3rC1PD0y803f5tgjalj7cM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424225795"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006637844eccd0de47923e06cd27364637000000000200000000001066000000010000200000004ab3097eae2908cf8ea9844eb0b544b053eb90da43f4f887b82d33eb3307bf1b000000000e8000000002000020000000ba694ea7e0b1532c4b5ad4b6c35230c3c980a136f47a6701be7dc9c31e9efbc420000000cb57156919d1822ad9facbe466737ff1b982adfbf2acf1375d5537790dbd1a4740000000b8bcece3fa80dc8f695f88f93ffb41c9087ebc9bff93343b472b641b6c82e227354a299d7da84da00f64e1fe3d86e571acf775858b296c6819325d8e42c27745	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006637844eccd0de47923e06cd2736463700000000020000000000106600000001000020000000fcacdaee5018405862b6b66eae5d326ce179f1c6c2c5f0a80ba42d475db6dbf0000000000e8000000002000020000000d9a5da3f71620e9c3fc2abb9370844da32801ab0c3d5c652a621ff0584d93281900000003cd42233b24d71f24c389343c0ecda2e2a1576b5604394700435c41b299e4e9577faba9e6cec7a05f4fe065d728cfa59ff3b834ff7b12e210ae88ef1b89ca36138a4000de434e8de9477ba85c274097e64407b3155b83272f729bac07643961cdfe2726bff4c98071ce5a560052bb658baabfd233dd6b75e2d88c2c042ca4f2cba3b68e418560d9fc4d7f726514b0295400000007842c896e5524c59e26a619dbb169e17331f756547529bde3ffc08f67040290132eb5b349d82996986b1082918f7bf7b69cc34eb9998dccfb33e00a0a1243138	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002c203992bbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{605C15E1-2785-11EF-BEEC-D20227E6D795} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1648	2124	iexplore.exe	28
PID 2124 wrote to memory of 1648	2124	iexplore.exe	28
PID 2124 wrote to memory of 1648	2124	iexplore.exe	28
PID 2124 wrote to memory of 1648	2124	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c5ff87d87b833220e0f9c92da8d3dc2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
027962f702fbb807520072baa69a02a8

SHA1
0a3777bd1a78309cc8c5bb3636cb442cb9b94bda

SHA256
15f47b5fcfdc747b411eae91bc25fd88061b9444f3e1f3a747ccf21b43f02621

SHA512
d002a4da7ba53f1ea55d9b8ec4ea676335ce87bad2ae5669b782f5c8cc4ad2c929443554f1a2ae25e7f67099114b17549786d1d0e74643a7f24f259f0812dd54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df10a31384ca41cbe2315187cb232b01

SHA1
20a88dbe3d22c7e18c510958c4c51e7905fb7550

SHA256
7b6c751817b03a280ecdf175ff23502cdae580e7053a4a1a066b4b31202ad3d2

SHA512
e49dd5a6c472c83d80b1ed1c04141019fc3185402e99ea19edfc2d3553ccaac7e09cf822075d1943df99d6ef476a1a671a8b9cc92a6db5221479cf508e10edee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a437c9c120ade7527d0b00a5104585a

SHA1
b4d881d3c2f6e38150f3822437f136153c301235

SHA256
c90bef0af1680b4ad80b4916b5ecefcd7dd1269cf229c0583beb739bbf5eda4c

SHA512
33ac18aa9afe19578de8991b618a11a354845c10970dc3413cef6531c3c1be4fd057e4eb017fed9696f6f68ef945416d33e222a98f78d19cacddb85726b2b21f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a570bf40acbd0db33924c6c1e9800b6

SHA1
b8a57674b4d1aa809d26dbf1bd2829900457578c

SHA256
eed5b77f753eace8d85faa7bdc36b8b6eb69d7117ab468f480e76a396fff4e77

SHA512
c95fe721ca8a39ff2ed621b2af0f48af4f91ae03227499f0d01825b942fcda8a8030e3035689330fbb949e0b2721803fd9261b16dadc68aca3e1500533335a39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0889def62391df70fc064a2840863b21

SHA1
4bf667726f615385d6ff410b251e438c9ac85cae

SHA256
6f8f6401d88a138e9a5c4f9526f84a78b44dd69d8159ffbb99ae5c89d597975c

SHA512
8e03fa2d8608f65d51363d31dc227c5d93f181399e352688ed046ca3504d58132ae169d1ad4e01d863218a9b7db313933a911bc5e110813d88f03d5df7024bc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c1298fee8342ef3ddc77604dc78defe

SHA1
299d4bdadbec0cc0a9af8138cda5a5aa4840e225

SHA256
df143e45eea841f9664542dff43d3138181867620de94876c2b459517f870dc9

SHA512
82fe607a01a34503a073fe571cff021baa406fc91858b1aa9a9cc89f8890fda90abe7a2b3d0cb51d3fb88e99fbe0d91e16c90ffa6f0a250a3db1d8cf14b6416c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e80be99bb4023ebf7fb25ebe5f1d8a94

SHA1
a9e0304f8fa7cce16b494affae3c2db45b8137e2

SHA256
23081d304bca9e580cfe784a0bfeba9fd19816b7c57bd0c2d2ea4092344ad943

SHA512
e71808aa759e825174c9542a93a906eb6053413d8c8b4f1817170bfe87a6a5072fafa4701ddb4962c77d2a817aec1876d8a35e505bca5466c7d04e1f01d289d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef1c3e524a344f53bb0d1e21447461f2

SHA1
40ff9a9ad4090f5ced2537cf121246e3c52052c5

SHA256
4ebdf25a649cbe851bc8e8a622a7c830c4dd14b2f291f8538afe01dd130e79ff

SHA512
57568540c6db1941db543f97ca811961e146689de474fde4f1ae57f3ef4899823c2b5feaaca3f688b935e20184a6a9ec92d0df02cf30eaa2a7fd1e5db16f431b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fca83ce9686700c27bd7e94ff8e18d7

SHA1
7bde3b540afa79bc9d0ebf1c5520634af1041b66

SHA256
0282f3d4c8c1afc4c8d7a938993fe852f607ed7e2d63fdcbeb4967698fe40522

SHA512
6626480a0732b7027bd529d5df2a2207da2d9aa1dc16e5cf22a79595ca64145de0b8368ea3521b287b0b99265946b3b2dad3c4da86ada3ddad9ea92311868f33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df277dafa1c619a6647af1dd33a86928

SHA1
748e84226be40703a7c7017467e8d0d0e91f7242

SHA256
4adac8fce8130f5e63babe799f197ed887f418bc4667fcbb949a006e83d7ee9b

SHA512
8da6d0eaa59f99229be10cc2cfd3ab64d856f99460d7aa8b41787ee3f3f3c9228289e2408151c3299e91934ef7468fe7bbc1867b3ec47b42b90bf2f02d55ad63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1c622723bb6cb69278935ecd8334bbf

SHA1
b58f2faac2758f9917a1f414156f3eb09a9d4831

SHA256
f26e97c378a39de92379bf25b348b713a82ca0b021885f2dc47fa189a946275e

SHA512
b2024fc439607a49db1f237b447f3b701a2560115bf8aec5a38e4c0825212baf0f39df3ec5da1a9bf0f258657264d3080ed75dbea004dae30632e7ee2c4f15f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb7c16727454672d0d1515b90c294a91

SHA1
2b8e99c54e76bc60efeba0b9538ee87057710db0

SHA256
e726516f59b0d5985ba37a4a50fceb260003700aee2306e8f5ee702ba22e7ef5

SHA512
97128cd23b7162b946bf61b79d82d44624c99f152fd6a81ea76d19b3b1f86f06368cb72dd9e4a61ba413a88af82952f7badc112eecd17632c4f3f60d2444efc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b1406a1087757896ea9df2d43b7eeac2

SHA1
d92a215ea0e6effbb094c4d5aab8a2e7d848f24a

SHA256
4cef0607a4319911dd74e180be727e40f0395af24880b109c5b6b7a91780c339

SHA512
72fc19961e844834fe3ea5c87d03ad43c94c2f707d63d877b53763f496748b074f4992597b3d0193f8bce0b32b025b2e756d9cd2dcc9b8dfae3ff3a6bfe0e340

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab47BB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4E57.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit